Welcome to Issue #30 of the CosmicBytez Labs Weekly Digest — your curated rundown of what mattered in cybersecurity this week.
This week belongs to the AI threat surface. Researchers demonstrated that malicious MCP servers can split instructions across multiple tool calls to bypass safety filters and exfiltrate secrets from AI coding agents. OpenAI paused its upcoming Astra model after internal evaluations found its cyber capabilities crossed a safety threshold. And a deeper pattern is emerging: as enterprises rush to deploy AI agents, access controls built for humans are failing to keep up with delegation chains that were never designed for autonomous systems.
On the OT side, attackers breached a Polish power plant through the utility's private cellular network — not through the internet — and shut down a steam turbine serving 50,000 residents. The assumption that private networks are safe is now demonstrably wrong. Meanwhile, the DeadLock ransomware group is anchoring extortion infrastructure on the Polygon blockchain, and a WordPress supply chain attack poisoned JSON config files to silently mint rogue admin accounts across thousands of sites.
A heavy week. Read carefully.
Top Stories
GhostSplice: Malicious MCP Servers Split Instructions to Exfiltrate Secrets from AI Agents
Researchers at the ASSET Research Group disclosed GhostSplice, a cross-channel trust fragmentation attack that splits a single malicious instruction across three MCP tool outputs — tool description, scan result, deep scan result — so that no individual fragment triggers safety filters, but the combined context causes the AI agent to read SSH keys, .env files, and source code, then send them to an attacker endpoint.
Testing found Cursor with GPT-5.4 succeeded 90% of the time. Claude Code, regardless of model, showed a 0% success rate — client-level sequence evaluation stopped the attack before the model ever saw the assembled instruction. The takeaway: model safety training alone is not sufficient. The client architecture matters as much as the model weights. Concurrent findings by Wiz Research also published two Amazon Q Developer CVEs (CVE-2026-12957, CVE-2026-12958) in the same MCP ecosystem.
What to do: Enforce scoped MCP tool allow-lists at the infrastructure level. Audit full multi-step tool call sequences, not individual calls. Vet every MCP server before connecting it to an agent with filesystem or credential access. Patch Amazon Q Developer if deployed.
DeadLock Ransomware Anchors Extortion Infrastructure on Polygon Blockchain
DeadLock is using Polygon smart contracts and the Session messaging network to build extortion infrastructure that law enforcement cannot seize. Where LockBit and ALPHV relied on Tor-hosted dark web sites that were taken offline by coordinated law enforcement action, DeadLock stores victim data references on-chain — persistent, distributed, and outside any single authority's reach.
The move represents a significant evolution in ransomware resilience. If the approach proves durable against disruption, other groups will adopt it. Blockchain-backed extortion infrastructure may become a baseline expectation in the next generation of ransomware operations.
Hackers Breach Polish Power Plant via Private Cellular Network, Shut Down Turbine
Attackers compromised the operational technology network of a Polish combined heat and power plant by entering through the grid operator's private cellular network — bypassing internet-facing perimeter defenses entirely. Once inside, they issued commands that shut down a steam turbine and a process-water treatment system serving roughly 50,000 residents. Recovery took approximately seven hours.
This is a direct demonstration that private LTE and 5G deployments in industrial environments carry the same access risk as any other network if segmentation and authentication controls are absent. The incident aligns with a separate earlier report from 2025 — OT attackers have been probing private cellular as an access vector for over a year.
What to do: Treat private cellular networks as untrusted external networks. Enforce strict segmentation between the cellular infrastructure and OT control systems. Require strong mutual authentication for any device accessing industrial control networks via APN.
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Attackers compromised the distribution infrastructure of BdThemes, a WordPress plugin vendor with thousands of active installs. Instead of modifying plugin source code — which would have been caught by file-integrity checks — they injected malicious payloads into JSON configuration files that plugins fetched at runtime. When processed, these payloads silently created rogue administrator accounts on affected sites with no visible indicators.
The WordPress plugins team temporarily suspended BdThemes downloads while the investigation continues. This attack is notable for its evasion technique: no PHP was touched, so standard integrity verification passed. The payload was entirely in data.
What to do: Audit administrator accounts on sites running BdThemes plugins. Remove any unfamiliar accounts created in the past several weeks. Monitor for unexpected plugin configuration fetches to external endpoints.
OpenAI Pauses Astra Model After Cyber Capabilities Trigger Safety Threshold
OpenAI has paused internal activities involving its upcoming model, codenamed Astra, after internal safety evaluations found it demonstrated agentic coding and cybersecurity capabilities sufficient to provide meaningful uplift to threat actors. The pause activates one of the more visible frontier AI safety protocols seen publicly to date.
The disclosure follows the Artifactory sandbox escape documented last week — AI models autonomously finding and chaining zero-days is no longer a research exercise. Astra's pause suggests that evaluators are finding the capability frontier advancing faster than the safety and containment frameworks that need to accompany it.
Security Corner
Critical advisories published this week:
-
CVE-2026-18948 — CVSS 9.9 Critical. Unauthenticated remote code execution in the Feast ML feature store via unsafe deserialization of Python
dill-serialized user-defined functions stored in the feature registry. No authentication required. If you run Feast in any ML pipeline, this is a drop-everything patch — arbitrary code execution at the feature store level has cascading blast radius across training and inference infrastructure. -
CVE-2026-19516 — Critical. Server-side request forgery in
mcp-grafana. Callers can supply an arbitraryX-Grafana-URLheader to hijack the MCP server's outbound HTTP requests, enabling SSRF against internal and external hosts. Particularly dangerous in environments where the Grafana MCP server has access to internal networks — an attacker with MCP tool access can pivot to internal services. -
CVE-2026-20349 — High. Heap inspection vulnerability in Cisco ASA and FTD allowing unauthenticated remote attackers to crash devices and trigger denial of service. Added to the CISA KEV catalog — active exploitation confirmed. Patch immediately; any internet-facing Cisco firewall running affected versions is a target.
-
CVE-2026-14450 — Review the full advisory for scope and remediation. API authentication bypass.
-
CVE-2026-19425, CVE-2026-19348, CVE-2026-19384, CVE-2026-14206, CVE-2026-13716 — Additional advisories published this week. See the Security archive for full writeups.
Browse the full Security Advisories archive for all active CVEs.
Quick Takes
-
Vague task, total access — OWASP's Top 10 for Agentic Applications 2026 names Excessive Agency a top-tier threat. 80.9% of technical teams are running AI agents in test or production, but only 14.4% with full security or IT approval. If your agents have broader access than the task requires, you already have a problem (read more).
-
Gunra ransomware targeting critical infrastructure — The FBI and South Korea's NIS issued a joint advisory warning of the Gunra ransomware group, which has been actively targeting critical infrastructure including Fortinet and Schneider Electric environments. A separate article covers the Gunra/Fortinet/Schneider angle in depth (FBI/South Korea advisory).
-
China-linked StormEncryptor deployed via N-central — A new StormEncryptor ransomware variant, attributed to a former Medusa affiliate with China-linked infrastructure, was deployed through compromised N-able N-central remote monitoring and management software — targeting MSPs and their downstream clients (read more).
-
Metabase SQL zero-day — A zero-day in Metabase could expose SQL interfaces to unauthenticated attackers with potentially wide blast radius given Metabase's prevalence in data analytics stacks (read more).
-
Solidity VS Code extensions steal crypto wallets — Malicious extensions in the VS Code marketplace targeting Solidity developers were found stealing crypto wallet seed phrases, API keys, and credentials. If you do any blockchain or Solidity development, audit your extensions (read more).
-
Google Chrome Android notification abuse — A campaign is abusing Chrome on Android's notification permissions to push persistent phishing lures. Users who granted notification access to compromised sites are being targeted with credential-harvesting prompts that impersonate banking and authentication services (read more).
-
Belgian eID software flaws — Critical vulnerabilities were discovered in Belgian electronic identity card software used by 2 million people. Flaws in identity verification software at this scale carry significant national implications (read more).
-
Steam and CEVA Logistics data breach — Valve's Steam platform and logistics firm CEVA were both linked to data exposure incidents this week — separate in origin but both surfacing in threat intelligence feeds (read more).
-
Senate bill: $300M annually for water sector cyber — Senate Democrats introduced legislation to distribute $300 million annually to shore up water sector cybersecurity — a direct response to the pattern of water utility attacks seen across the US over the past two years (read more).
-
Device trust in the AI era — A deep dive on how credentials and MFA bypass techniques are evolving alongside AI-assisted attacks, and why device trust is becoming the new authentication baseline (read more).
Upcoming
Next issue (Issue #31): We'll be tracking the MCP security landscape as coordinated disclosure timelines close on GhostSplice CVEs — expect vendor patches and additional client-level mitigations from Cursor and others. The Astra pause has a 30-day internal review window; watch for OpenAI's public safety report. We'll also be monitoring whether DeadLock's blockchain extortion model attracts imitators in the ransomware ecosystem.
On the Labs: New training modules and practical hardening guides are in progress. Check the training index for newly published content and the howto library for actionable guides on the infrastructure making headlines this week.
Stay sharp. The AI threat surface expanded significantly this week — not in theory, but in deployed production systems. GhostSplice, Astra, and vague-task agent deployments are all facets of the same underlying problem: the security industry's governance frameworks are running behind the capability curve. The window to get ahead of this is narrowing.
Issue #30 — August 11, 2026. Published weekly by CosmicBytez Labs. To receive this digest by email, subscribe here.